Description
Fix and verify all 19 confirmed findings from Codex Security scan b3c6de8e-d3d0-434a-bfe4-e6c5c764e02f against revision 1f1175fcc1d4470bae00458083a58f695a5280bf. Preserve documented receiver modes and legitimate operator workflows while closing each reported security boundary.
Acceptance Criteria
- #1 All six ingress and local HTTP findings are fixed and regression-tested
- #2 All four retained-state and filesystem findings are fixed and regression-tested
- #3 All six outbound credential, transport, URL, and TLS findings are fixed and regression-tested
- #4 All three Helm deployment findings are fixed and validated by deterministic rendering
- #5 The complete repository gate and CodeRabbit security review pass before commit and push
Definition of Done
- #1 go build ./… && go vet ./… && go test -race ./…
- #2 golangci-lint run
- #3 scripts/regen-generated.sh (only if a generated artifact’s inputs changed)
Implementation Plan
Run contract: docs/superpowers/2026-08-25-security-remediation-goal.md. Execute child tasks sequentially in order .01 through .04, then one integrated review and final gate.
Clear the shared repository gate by registering the five reusable-workflow call jobs, adding trigger-appropriate concurrency to arm-automerge and ghcr-cleanup, then rerun focused and full gates before atomically finalizing the parent and all four subtasks.
Implementation Notes
All 19 scan findings are fixed and independently reviewed. CodeRabbit second pass had no Critical or Warning findings. Build, vet, lint, affected-package race suite, govulncheck, generators, Helm, and Windows cross-build pass. The literal full race suite remains blocked only by seven unchanged internal/ci workflow-contract assertions for workflow files outside this remediation diff; acceptance criterion 5 and DoD 1 remain unchecked.
Cleared the unrelated current-HEAD workflow-contract blocker by registering five reusable-call jobs and adding trigger-appropriate concurrency to arm-automerge and ghcr-cleanup. Full build, vet, race suite, lint, and actionlint passed on 2026-08-25.
Final Summary
Remediated and regression-tested all 19 findings from scan b3c6de8e-d3d0-434a-bfe4-e6c5c764e02f. Security implementation is complete; tracker remains Parked solely at the unrelated current-HEAD workflow-contract gate.
The repository gate is green and all acceptance criteria are satisfied.
The earlier Parked handoff is superseded by this gate fix; the task and all subtasks are Done.